At present, hydrocarbon pricing pays strong dividends
for hydrocracking (HC), which leverages low-cost hydrogen
(H2), sourced from todays abundant natural gas
supply, into high-value liquid fuels. Among hydroprocessing
(HP) units, HC units have the greatest H2 uptake,
with a typical liquid volume swell of 10%. This earns in the
range of $100 million (MM) per year for a 30,000-barrel-per-day
(bpd) HC unit based on volume swell alone, in addition to the
usual value upgrade of HC conversion.

As a result, hydrocrackerswhich are already one of the
hydrocarbon processing industrys
most demanding process control challengesare being pushed
to greater limits. HC reactors operate at elevated temperatures
and pressures, making safety a constant concern. Recovering
from temperature upsets can take hours, and recovering from a
complete depressurization takes days. Reactions are exothermic,
meaning that even minor disturbances in feed, heater or quench
controls can rapidly escalate to an urgent situation. For these
reasons, HC controls have always demanded vigilant attention to
design detail, management of change, and operability. Any
oversights can result in, or fail to prevent, depressurization
events. Key improvements, on the other hand, can bring large
gains in refinery profitability and reliability.

For the past two decades, hydrocracker process control
strategy has focused on installing automatic depressurization
systems and multivariable predictive control (MPC). While this
equipment has brought important gains, experience shows that it
leaves many gaps in excursion control and depressure
prevention. This article presents an updated hydrocracker
control model that robustly addresses traditional hydrocracker
control challenges, overcomes outdated hydrocracker control
paradigms, and allows hydrocrackers to operate safely, reliably
and profitably under todays demanding conditions.

HC process and economics

Fig. 1 shows a common hydrocracker
configuration. Heated oil and excess H2 enter a
vertical downflow reactor with multiple fixed catalyst beds.
The catalyst promotes cracking and hydrogenation of larger
hydrocarbon molecules, such as gasoils,
cycle oils and coker oils, into lighter, more valuable
molecules, such as diesel, jet fuel and naphtha. The overall
reaction is exothermic, so temperature increases as flow passes
through the bed.

Between beds, cold H2 quench gas is introduced to
cool the reaction mix. In this way, the reactor is a succession
of cracking beds followed by quenching (Fig. 1
depicts three beds, but often there are more). The overall
objective is to achieve the desired amount of cracking (or
conversion), which is borne out in the downstream
fractionation section product spreads.

Maximizing conversion means operating at one or more of the
quench constraints. These include a maximum quench valve
position, chosen to ensure ample reserve quench should an
exothermic excursion occur, and a maximum bed temperature rise,
which indicates high cracking severity and increased risk of a
rapid onset excursion.

Recent price trends in crude oil and natural gas have
shifted HP economics. The price of natural gas has declined,
while the price of crude oil and liquid fuels has greatly
increased. H2 consumed through a hydroprocessing
complex swells the liquid yield, effectively converting a
low-cost feedstock into a high-value
product.

Among HP units, HC has the greatest H2 uptake,
typically around 1,700 standard cubic feet (scf) of
H2 per barrel (bbl), with a resulting liquid volume
swell of 10%. Therefore, the gross profit margin from volume
swell alone is in the range of $100 million (MM) per year for a
30,000-bpd HC unit. This is based on H2 sourced from
natural gas at $4/thousand scf, and valuing product fuels at
$120/bbl.

Past strategies and present gaps

Over the past 20 years, hydrocracker process control
strategy has focused on installing automatic depressurization
systems and MPC. While these are important, experience now
shows that they leave many gaps in excursion control and
depressure prevention.

Auto-depressure controls serve to vent reactor systems to
flare in the event of an uncontrolled exothermic excursion, to
halt the reaction and prevent vessel temperatures from
exceeding metallurgical limits. Temperatures during an
exothermic excursion sometimes increase tens of degrees in as
many seconds. Industry history shows that manual depressure
systems are often not used according to written procedures and
that personnel at all levelsmanagerial, supervisory and
operationalcan have difficulty balancing production goals
with safe use of manual depressure systems.1 This
illustrates why auto-depressuremade possible by more
reliable thermocouple-based temperature-measurement systems and
improved algorithms for excursion detection and
temperature-measurement quality handlinghas become
essential.

The difficulty with auto-depressure controls is that they
tend to act much sooner than traditional, manually initiated
systems, and depressuring is to be avoided whenever possible,
except as a final layer of safety. Depressuring a reactor
brings the unwelcome prospects of prolonged restart, impact on
other refinery units, large economic losses, thermal and
mechanical stresses to the reactor and associated equipment, environmental flaring violations,
and potential harm to the company image in the community and in
the industry. The necessary message that often fails to
accompany auto-depressure projects is the need for better
excursion control to avoid reaching auto-depressure conditions
in the first place.

MPC technology has brought improvements
in reactor bed temperature balancing, weighted average bed
temperature (WABT) control, and coordination between reactor
and fractionator sections (conversion control). However, MPC
lacks the speed, reliability and control features
necessary to adequately respond to most hydrocracker
disturbances before they result in an excursion, or to contain
an excursion before it leads to depressure, or to do so in a
manner that minimizes overall impact on reactor temperatures
and resulting lost production.

Excursion scenarios

Hydrocracker operators are always aware of the many
potential excursion initiators. On the other hand, when
designing controls (and even during hazard analysis), there is
a common tendency to downplay the likelihood, severity and
actual history of many excursion scenarios.1 For a
hydrocracker (or for any critical process control), an
effective approach is for a multidisciplinary team to consider
each scenario and the most appropriate control system response.
Common excursion scenarios include:

Loss of oil feed. A feed pump trip
normally results in a strong excursion unless quickly
quenched, because the oil stops moving through the bed and
instead cracks in place, never reaching the
quench zone.

Maldistribution. Bed inlet
maldistribution can cause erratic quench controller behavior,
especially if a single measurement point is used for control
or if inter-bed redistribution internals are not functioning
properly. Maldistribution of flow through the catalyst bed
creates localized low flow conditions and hot
spots where excursions can take hold.

Production changes. Although operating
procedures are designed to implement changes conservatively
and safely, excursions commonly occur during changes to feed
rates, feed type or temperature (i.e., conversion).

Additional potential excursion triggers are listed in
Reference 1. Complex refineries with a variety of feed and
product types can be subject to these hazards on an essentially
continuous basis. Understanding these causes helps build better
controls; however, the control design must also provide
effective excursion control, regardless of the cause.

Layers of control

Fig. 2 is a hydrocracker reactor control
model that addresses safety, depressure prevention, and
excursion control, along with normal operating objectives and
optimization. The overlapping of layers indicates robust
reliability. For example, excursions may be contained and
controlled by Layer 4, 3 or 2 before ever reaching Layer 1
(depressure). In addition, Layers 4 and below are implemented
in the base-layer control system, thereby maximizing
responsiveness, reliability and operability.

Fig. 2. HC reactor control
model
showing layers of control.

Auto-depressure on high temperature is
becoming established as an industry best practice. Key design
decisions include whether to implement auto-depressure in the
safety instrumented system (SIS) or the distributed control
system (DCS); whether to depressure on high temperature
rate-of-change (in addition to high absolute temperature);
and how to robustly handle low-quality temperature
singularities among the bed outlet thermocouple arrays to
avoid unnecessary or nuisance depressurization events.

Auto-quench causes the quench valves to
open on high excursion temperature to avoid reaching the
depressure limit. It may also trigger preemptively on feed
pump trip and initiate heater minimum fire logic. Auto-quench
design is a balancing act: it should be robust, like a safety
function, but without being so heavy-handed as to result in
an extended recovery time; it must trigger early enough to
avoid reaching depressure, but without triggering
unnecessarily; and it should not interfere with, or be
defeated by, quench controls in manual mode. Although
auto-quench is a DCS control, conceptually it can be one of
the most important functions in a refinery, since it is the final
layer of depressure prevention.

The excursion control layer is designed
to handle excursions as routine control disturbances, when
possible, to minimize their impacts. This renders most
excursions as non-events, such that they go largely
unnoticed, except perhaps by the DCS operators. In the past,
operators remained alert to take manual control in the event
of an excursion, but with excursion controls, operators learn
to keep them in the correct mode to ensure reliable automatic
response. As one operator noted, These are controllers
that work for us, and not the other way around.

The excursion control layer comprises a number of
traditional advanced regulatory control (ARC) techniques
applied to the bed inlet, bed outlet and heater controllers. An
important aspect is converting the Bed 1 quench valve
(TC-IN-1A in Fig. 1) to a bed
outlet temperature controller (TC-OUT-1A in
Fig. 3) and coordinating its action with
heater control. This critical valve is often configured
problematically (as in Fig. 1), so that it
does not respond to an excursion and, when used, can cause the
heater(s) to counter with increased firing.

In retrospect, operating an exothermic reactor without
bed outlet control defies common sense,
although it is a common practice, especially when MPC is
switched off, detuned, clamped or over-constrained. Even if
the excursion control features are absent, outlet control at
least helps prevent many gradual process variations from
reaching excursion thresholds. It also brings increased
stability to bed outlet temperatures, WABT and conversion.
However, simple outlet controlsans the excursion
control features, including MPCusually will not contain
an excursion once it begins.

MPC-based WABT control, when implemented
in the new model (Fig. 3), would write to
the bed outlet controller setpoints rather than to the bed
inlets, as is traditional. The bed outlet controllers provide
base-layer stability and excursion control, while MPC
provides traditional WABT control and constraint management.
As an alternative, WABT control can be implemented as a
custom algorithm, providing greater flexibility in how the
constraints are managed. This also facilitates a variable
WABT ramp rate that can be both faster and safer during
startup and recovery operations, capturing extra hours of
on-target production. Since the base-layer controls handle
stability, this custom WABT algorithm is similar to, and no
more complex than, a traditional heater pass balancing
control.

Conversion control involves moving the
WABT setpoints based on fractionation section product
spreads. MPC is a good choice for handling the long response
times involved, although a rudimentary custom algorithm can
also be used. A limitation is that feed quality changes are
the primary disturbance, and they are often much bigger
than the handles, since WABTs can only be moved
gradually and within limits. Another key consideration is a
smart-conversion calculation and scheduler, so that
fractionator disturbances are not back-propagated to the
reactor section.

Metrics

Excursions are commonly quantified as the difference between
real-time reactor bed temperatures and recent (heavily
filtered) values. The excursion value reflects any short-term
temperature rise; i.e., the severity of an excursion. At
steady-state, this value will be zero, and at operating
conditions (if procedures are carefully followed and no
excursions occur), it will always be less than the prescribed
maximum hourly rate of change; e.g., less than around
5°F.

Since modern hydrocracker reactors may have a dozen or more
thermocouples per bed, a common practice is to calculate the
highest temperature of each bed for monitoring and alarming,
for ease of operation, and to avoid alarm floods when
excursions occur. Fig. 4 is an example of the
long-term trend of the highest excursion temperatures for each
bed of a two-stage reactor. The vertical axis shows excursion
severity (for example, increments of 5°F).

Fig. 4. Improvement in
excursion control.

Excursions below a severity of 1 reflect routine daily
operation. Excursions with a severity between 1 and 2 may occur
daily, weekly or monthly, depending on the quality of
operation. Excursion controls should take effect at this level.
Excursions greater than a severity of 2 are increasingly
serious and, in many cases, warrant near-miss investigations to
prevent recurrence. These investigations often lead to the
types of control improvements described here.

Fig. 4 provides a meaningful metric of
progress and of ongoing quality of operation. As controls are
upgraded, the frequency and severity of excursions decreases.
As with any safety metric, frequent, minor excursions indicate
the increased likelihood of a full-blown excursion and
potential depressure event. A graph like that shown in
Fig. 4 is a good candidate for visibility on a
large control-room screen, as a means of sustaining improvement
and awareness.

Recommendations

A guiding tenet in the evolution of these controls was to
utilize quench, heater and other controls as advantageously as
possible under all circumstances, to contain excursions and
avoid reaching auto-depressure conditions. This led to many
creative and sensible ideas. The main challenge was not in the
difficulty of designing new controls reflecting these ideas,
but in overcoming entrenched paradigms about the old controls,
even though they were outdated or not sensibly configured in
many cases, such as the conflict between the Bed 1 quench and
heater controls, and the lack of reliable bed outlet
control.

Control layers 2 through 4 were implemented with standard
DCS functionality, bringing cost and engineering advantages.
Another practical benefit is operability, since these controls
present to the DCS console operator and behave as conventional
cascaded controls, requiring minimal new concepts and
training.

MPC is often considered a comprehensive solution for the
types of control concerns raised here; however, none of the
critical excursion control, depressure prevention or
auto-quench functions are of the type provided by MPC. For
design or hazard and operability study (HAZOP) purposes, it is
usually better to view MPC as a gradual constraint pusher,
rather than as a reliable disturbance handler. This distinction
is important on any process, but especially for hydrocrackers,
where a robust response can make the difference between an
online reactor and a depressured reactor, in a matter of
minutes.

Process control could benefit by borrowing from safety
system practice and convening a multidisciplinary team to
review critical process upset scenarios and arrive at the most
appropriate and advantageous automatic control response. While
many processes do not have the rapid downside potential of HC
reactors, the general principles of maximizing on-target
production and avoiding safety function thresholds under upset
conditions make this approach a good practice for any refinery
unit.

The traditional practice of operating high-pressure,
high-temperature, exothermic reactors without reliable,
nonlinear bed outlet temperature control is a paradigm that
industry should proactively remedy. The auto-quench, excursion
control and bed outlet layers should join auto-depressure as
industry best practice for all
hydrocrackers. HP

Allan Kern has over 35 years of
process control experience and has authored dozens of
papers on multivariable control, inferential control,
safety systems and distillation control, with a
focus on practical process control solutions and
effectiveness. He is a professional control systems and
chemical engineer, a senior member of ISA and a
graduate of the University of Wyoming. Mr. Kern is a
consultant, and he can be contacted at
Allan.Kern@APCperformance.com.

Have your say

All comments are subject to editorial review.
All fields are compulsory.